▸ Blog
Notes from the trenches.
Laravel internals, AI engineering with Claude + MCP, RAG pipelines, Shopify Plus, DevOps. Production lessons from shipped work — every post earns its slot. Featured = hand-picked or most recent.
▸ 97 posts · last updated
Nov 12, 2026
▸ New here? Start with these
Browse series▸ Search the blog
Browse by topic.
▸ Pick a lane · click a card to filter
Latest drop.
▸ Most recent · or pinned by hand
Migrate Storefront MCP carts to UCP Cart MCP
Storefront MCP get_cart and update_cart on /api/mcp are deprecated. Move agents to UCP Cart MCP at /api/ucp/mcp with create, get, update, and cancel.
Read post →
More posts.
▸ 9 of 96 · paginated below
-
ArchitectureMCP first is the new mobile first
Mobile first made every screen work on a phone. MCP first makes every product capability work for an AI agent: tools, skills, and permissions before the human UI.
Read post →
-
LaravelMCP auth and audit logging in a Laravel SaaS
An MCP server on Laravel is only as safe as its tenancy boundary. Scoped tool auth, request-bound actor context, and an audit log you can actually read at 3am.
Read post →
-
AITrust is not a QA strategy: test AI code too
AI code is 95% syntactically clean and fails security tests 45% of the time. Half of agentic PRs ship no tests. The verification pipeline I run instead.
Read post →
-
ShopifyBuilding secure agentic commerce on Shopify in 2026
How agentic commerce on Shopify stays safe: UCP negotiation, an MCP governance layer, scoped credentials, signed requests, and human approval at checkout.
Read post →
-
ArchitectureMCP vs A2A vs ACP: the agent protocol stack
MCP connects agents to tools, A2A connects agents to each other, and ACP has folded into A2A. How the two-layer agent protocol stack fits together in 2026.
Read post →
-
LaravelYour Laravel MCP server now checks Origin. APP_URL just became a security setting.
Laravel MCP 1.2.0 returns 403 to a browser request whose Origin is not your APP_URL. That makes APP_URL part of your MCP security, and the allow list is a config key that is not in the config file.
Read post →
-
DevOpsWrite is not delete: Coolify just changed your API and MCP contract
Coolify 4.6 and 4.7 changed the contract: a write token can no longer delete, and a newer git push cancels the older queued webhook deploy by default.
Read post →
-
AIMeta Muse for Solo Founders: The Guard Outside the Agent Matters More Than the Agent
Meta's personal agent takes action on its own cloud computer and keeps working after you close the app. Sentinel sits outside the model. Price as of 28 October 2026.
Read post →
-
AIOpenAI Dots for Solo Founders: An Always-On Agent in Slack and Teams, on Your Rules
One always-on ChatGPT agent keeps working on its own cloud computer after you close the laptop. Custom Rules, Slack and Teams, and the Pro price as of 28 October 2026.
Read post →
Tags.
▸ Search by specific tech